The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill contains instructions to download and execute an installation script from RevenueCat's official repository (https://raw.githubusercontent.com/RevenueCat/rc-claude-code-plugin/main/install.sh) using a piped-to-shell command. This is documented as a standard setup procedure for the provider's official CLI plugin.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its handling of untrusted data from the RevenueCat MCP server.
Ingestion points: Data retrieved from the RevenueCat API through MCP tools like list_apps, get_app, and list_products defined in SKILL.md.
Boundary markers: Absent; there are no instructions for the agent to use delimiters or ignore potentially malicious content embedded within API responses.
Capability inventory: The skill allows the use of Bash, Write, and Edit tools, which could be leveraged to execute commands or modify files if the agent is misled by injected content in the API data.
Sanitization: No sanitization or validation of external data is specified before it is processed by the agent.
[COMMAND_EXECUTION]: The skill directs the agent to use the Bash tool to perform environment setup, including adding MCP servers and installing development plugins.

revenuecat